Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe your problem

Some of the Dockerfile files in this repo use the VOLUME instruction: https://github.com/ory/hydra/tree/master/.docker

PR that introduced VOLUME: #2129

VOLUME is not necessary:

• A container will persist it's internal state until it's destroyed (docker rm container_name, docker run --rm, docker compose down, etc). An anonymous volume is often mistakenly added despite being redundant.
• An implicit anonymous volume copies data from the image to the host per container instance created. This is wasteful and accumulates over runs.
• When persistence via a volume is actually necessary, it should be explicit (docker run --volume ./host/path/:container/path, or the volume key in compose.yaml, etc).
  • Anonymous (-v container/path):

    I want to persist the volume without a human-friendly name to reference

  • Named (-v my_data:container/path):

    I want a human-friendly name, but not easy access from the host filesystem, just persist my data externally from the container

  • Bind mount (-v host/path:container/path):

    I want to persist the data at a known location on the host filesystem that I can easily access directly

I also provided justification in 2022 for Caddy to do the same, citing various sources from other popular official images that likewise dropped VOLUME (which is effectively a legacy feature that causes more problems implicitly than benefits).

Describe your ideal solution

Remove VOLUME from the Dockerfile lines referenced (this would be applicable to other Ory projects too).

Workarounds or alternatives

• The redundant copy can be avoided.. if the user provides their own bind mount to the same mount point at runtime (anonymous & named volumes copy container content by default, bind mounts replace).
• Alternatively, the --rm option will remove the container on exit, additionally discarding the implicitly created anonymous volume. This doesn't prevent writing a copy of the volume data to disk, which if large slows startup.

Ideally though, without a real reason to keep VOLUME, it should just be removed from the Dockerfiles? 🤷‍♂️

Version

2.1.2